KR102277870B1 - Method for preventing automatic login using random script, and server for executing the same - Google Patents

Abstract

Provided are a method for preventing automatic login using a random script, which efficiently blocks web scraping through automated programs, and a server for executing the same. According to one embodiment of the present invention, the server comprises: a request receiving unit receiving a script request for logging in or moving a web page from a client; a randomization unit randomizing a parameter key, a parameter value, and a uniform resource locator (URL) for login or web page movement to generate an obfuscated script and storing information included in the obfuscated script in a set mapping table; a response unit transmitting the obfuscated script to the client in response to the script request; and a verification unit receiving the request of a random URL from the client as the random URL is generated from the obfuscated script and verifying the request of the random URL on the basis of the information stored in the mapping table.

Description

Method for preventing automatic login using random script and server for performing the same {METHOD FOR PREVENTING AUTOMATIC LOGIN USING RANDOM SCRIPT, AND SERVER FOR EXECUTING THE SAME}

Exemplary embodiments relate to techniques for preventing automatic login of the web through a program.

Web scraping refers to a technology or program that automatically accesses a web system by a program, extracts necessary data, and brings it. In general, web pages may contain sensitive data that should not be collected by third parties, such as personal information or customer data. However, recently, there are cases in which those who collect sensitive information such as personal information using automated tools or who aim for advertising revenue according to visit performance collect only data without accessing the web page. In public institutions, financial institutions such as banks, credit card companies, and securities companies, system stability problems due to web scraping are constantly being raised. In particular, when such web scraping is concentrated at a specific time, the service provided by a data provider such as a public institution or a financial institution may be slowed down or the server of the data provider may be down. As described above, the system operating cost and instability of data providers are increasing due to web scraping, and accordingly, there is a demand for blocking web scraping.

Korean Patent Publication No. 10-2015-0085716 (2015.07.24)

Exemplary embodiments are intended to provide a means to effectively block web scraping via automated programs.

According to an exemplary embodiment, in the request receiving unit, receiving a request of a script for logging in or moving a web page from a client; generating an obfuscated script after randomizing, in the randomizer, a parameter key, a parameter value, and a Uniform Resource Locator (URL) for logging in or moving a web page; storing, in the randomizer, information included in the obfuscated script in a set mapping table; transmitting, in a response unit, the obfuscated script to the client in response to the request for the script; receiving, in a verification unit, a request for the random URL from the client as a random URL is generated from the obfuscated script; and verifying, in the verification unit, the request of the random URL based on the information stored in the mapping table, an automatic login prevention method using a random script is provided.

The automatic login prevention method using the random script includes, before transmitting the obfuscated script to the client, generating, in the randomizer, N different obfuscated scripts; and storing information included in each of the obfuscated scripts in the mapping table for each obfuscated script.

In the transmitting of the obfuscated script to the client, one of the N obfuscated scripts may be transmitted to the client in response to the request of the script.

The generating of the obfuscated script may include permuting the parameter key and the parameter value, randomly setting an initial vector of a hash function, and then performing the hash function with the substituted parameter key and the parameter value. The obfuscated script may be generated so that the random URL is generated by hashing it as a function.

The generating of the obfuscated script may include randomly selecting whether to reverse the substituted parameter key and the parameter value, and any point of the substituted parameter key and the parameter value or the reversed value. The obfuscated script may be generated so that the random URL is generated by randomly adding a dummy value to .

The information stored in the mapping table may include one or more of the parameter key and information about before and after substitution of the parameter value, the initial vector, whether the inversion is performed, whether the dummy value is added, and a position.

The verifying of the request of the random URL may include verifying the validity of the random URL with reference to the mapping table, and extracting the parameter key and the parameter value based on information stored in the mapping table to extract the random URL. 's request can be verified.

According to another exemplary embodiment, a request receiving unit for receiving a script request for login or web page movement from a client; After randomizing a parameter key, parameter value, and URL (Uniform Resource Locator) for the login or web page movement, an obfuscated script is generated, and the obfuscated script is included in the a randomizer for storing information in a set mapping table; a response unit transmitting the obfuscated script to the client in response to the script request; and a verification unit that receives the request of the random URL from the client as a random URL is generated from the obfuscated script, and verifies the request of the random URL based on information stored in the mapping table, Server is provided.

The randomizer may generate N different obfuscated scripts, and store information included in each of the obfuscated scripts in the mapping table for each obfuscated script.

The response unit may transmit one of the N obfuscated scripts to the client in response to the script request.

The randomization unit replaces each of the parameter key and the parameter value, randomly sets an initial vector of a hash function, and hashes the substituted parameter key and the parameter value with the hash function to generate the random You can create the obfuscated script so that one URL is generated.

The randomization unit randomly selects whether to reverse the substituted parameter key and the parameter value, and place a dummy value at an arbitrary point of the substituted parameter key and the parameter value or the inverted value. ) can be added randomly to generate the obfuscated script so that the random URL is generated.

The information stored in the mapping table may include one or more of the parameter key and information about before and after substitution of the parameter value, the initial vector, whether the inversion is performed, whether the dummy value is added, and a position.

The verification unit may verify validity of the random URL by referring to the mapping table, and may verify the request of the random URL by extracting the parameter key and the parameter value based on information stored in the mapping table.

According to an exemplary embodiment, the obfuscated script may be transmitted to the client in response to the client's request for the script for login, and a random URL request may be transmitted to the server as the obfuscated script is executed. In this case, since the URL for login is calculated differently each time instead of being fixed as in the prior art, the automation program cannot transmit the HTTP Request in the desired form by the server.

1 is an example showing a general flow chart in which a client requests a login to a server
Figure 2 is an example showing a general flow diagram of an automated program requesting a login to the server
3 is a flowchart illustrating a method for preventing automatic login using a random script according to an exemplary embodiment;
Fig. 4 is a detailed configuration diagram of a server according to an exemplary embodiment;
5 is an example illustrating a process of generating an obfuscated script by the randomizer according to an exemplary embodiment and storing information included in the obfuscated script in a set mapping table;
6 is a block diagram illustrating and describing a computing environment including a computing device suitable for use in example embodiments;

Hereinafter, specific embodiments of the present invention will be described with reference to the drawings. The following detailed description is provided to provide a comprehensive understanding of the methods, apparatus, and/or systems described herein. However, this is merely an example and the present invention is not limited thereto.

In describing the embodiments of the present invention, if it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. In addition, the terms to be described later are terms defined in consideration of functions in the present invention, which may vary according to intentions or customs of users and operators. Therefore, the definition should be made based on the content throughout this specification. The terminology used in the detailed description is for the purpose of describing embodiments of the present invention only, and should in no way be limiting. Unless explicitly used otherwise, expressions in the singular include the meaning of the plural. In this description, expressions such as “comprising” or “comprising” are intended to indicate certain features, numbers, steps, acts, elements, some or a combination thereof, one or more other than those described. It should not be construed to exclude the presence or possibility of other features, numbers, steps, acts, elements, or any part or combination thereof.

FIG. 1 is an example showing a general flowchart in which a client 110 requests a login to a server 120 . In the present embodiments, the client 110 is a terminal possessed by a user, and may be, for example, a smartphone, a desktop, a tablet PC, a personal digital assistant (PDA), a notebook computer, or the like. In addition, the server 120 is a server of the data provider, and may be, for example, a bank server, a card company server, a securities company server, or the like. After accessing a web page provided by the server 120 through the web browser of the client 110 , the user may receive various data or related services from the server 120 through a login procedure.

To this end, the client 110 may request a script for login to the server 120 (S102). Here, the script is a programming language that can be executed without compiling the source code, and may be, for example, JavaScript.

Next, the server 120 transmits the login script to the client 110 in response to the request of the client 110 (S104).

Next, the client 110 receives login information from the user (S106). Here, the log-in information may be, for example, a user ID for log-in, a user password, and a certificate signature.

Next, the client 110 receives a click of the login button set by the user on the web browser (S108).

Next, the client 110 transmits an HTTP request to the server 120 (S110). In this case, the HTTP request includes the following three values.

1. Parameter key

The parameter key is a key required for a login request, and may be, for example, a user ID (UID), a user password (PWD), a certificate signature (SIGN), and the like.

2. Parameter value

The parameter value is a value corresponding to the parameter key, and may be, for example, a value of a user ID, a value of a user password, a value of a certificate signature, and the like.

3. Uniform Resource Locator (URL)

As the address for login, it is usually fixed, for example, login.do .

The client 110 may transmit an HTTP request including these three pieces of information to the server 120 .

Thereafter, the server 120 receives the HTTP request from the client 110, checks information included in the HTTP request, and allows the client 110 to log in (S112).

Figure 2 is an example showing a general flow diagram of the automation program 130 requests a login to the server (120). In the present embodiments, the automation program 130 is a software or application that automatically accesses a web system for web scraping and extracts and brings necessary data, for example, a scraper, a bot, etc. can be The automation program 130 may be installed in a terminal (not shown) of an attacker who wants to perform web scraping. In general, the automation program 130 has a parameter key, parameter value, and URL included in the HTTP request in advance. Here, the parameter key and URL are fixed values, and the parameter value may be input in advance from a user who wants to perform scraping.

Referring to FIG. 2 , the automation program 130 automatically generates an HTTP request based on the previously secured parameter key, parameter value, and URL ( S202 ). In this case, the automation program 130 may directly generate an HTTP request for login without opening a web browser unlike in FIG. 1 .

Then, the automation program 130 transmits the HTTP request to the server 120 (S204).

Accordingly, the server 120 receives the HTTP request from the automation program 130, checks the information included in the HTTP request, and allows the login of the automation program 130 (S206). Through this process, web scraping of the automation program 130 is performed, and system stability problems due to web scraping are continuously generated from the server 120's standpoint. Hereinafter, a method for preventing web scraping of the automated program 130 will be described in detail with reference to FIGS. 3 to 5 .

3 is a flowchart illustrating a method for preventing automatic login using a random script according to an exemplary embodiment. In the illustrated flowchart, the method is described by dividing the method into a plurality of steps, but at least some of the steps are performed in a reversed order, are performed together in combination with other steps, are omitted, are performed separately, or are not shown. One or more steps may be added and performed.

First, the client 110 requests a script for login to the server 120 (S302).

Next, the server 120 generates an obfuscated script instead of transmitting the fixed login script to the client 110 according to the script request of the client 110 (S304).

Specifically, the server 120 may randomize a script for processing an existing login request (ie, a script for an existing login) such that, for example, parameter keys and parameter values are substituted, respectively, as shown in Tables 1 and 2 below.

Parameter key randomization Existing parameter key substituted parameter key Script for existing login
value that exists UID ab PWD xyz SIGN f5 0 ~ N are randomly added as a newly added value c3a fun

Randomize parameter values Existing parameter values substituted parameter key The value that the automation program 130 has UID_value UID_value PWD_value ['PWD_value'] SIGN_value ['N', 'SIGN_value'] 0 ~ N are randomly added as a newly added value c3a ['axy'] fun [7, 'k5']

In addition, the server 120 may randomize the existing login script so that a random URL is dynamically generated through, for example, randomly substituted parameter information as follows.

Specifically, if the parameter key and parameter value newly created through Tables 1 and 2 are referred to as parameter information P, the parameter information P may be defined as follows.

P : ab=UID_value&xyz=['PWD_value']&f5=['N', 'SIGN_value']&c3a=['axy']& fun=[7, 'k5']

In this case, the server 120 may randomize the existing login script so that a random URL is dynamically generated through Step 1 to Step 3 below.

Step 1 : Perform message reduction through a hash function on the P value, and set the initial vector of the hash function randomly

HASH_P = Hash(P)_with_random_initial_Vector

Step 2: Randomly select whether to reverse HASH_P

RndReversed_HASH_P = Reverse(HASH_P)_with_random_reverse

Step 3 : Randomly add a dummy value at any point (eg, front, back, etc.) of RndReversed_HASH_P

URL = front_dummy(0~N char) + RndReversed_HASH_P + backend_dummy(0~N char)

Thereafter, the server 120 may obfuscate the randomized script as above to generate the obfuscated script. For example, the server 120 may obfuscate the randomized script by using various techniques such as Control Flow Flattening, Debug Protection, Dead Code Injection, and Self Defending. Scripts obfuscated through this process are difficult to decipher through real-time analysis.

In addition, as will be described later, the obfuscated script is executed as soon as a user clicks a function that can send an HTTP request, for example, a login button, and can generate and output a random URL calculated through Step 3. .

The server 120 may generate an obfuscated script through this method. In this case, the server 120 may generate N different obfuscated scripts. Here, the server 120 may randomize the above-described parameter key, parameter value, and URL in different ways. That is, the server 120 may also make a different randomization method (or encoding method) whenever it randomizes the above-described parameter key, parameter value, and URL. In this case, N obfuscated scripts of different types will be generated. can

Next, the server 120 stores the information included in the obfuscated script in a set mapping table (S306). For example, the server 120 provides information about the parameter key and before and after replacement of the parameter value (eg, the value before/after replacement of the parameter key and the parameter value, whether a new value is added, the actual parameter value) is put into the array or at which index, which dummy value is added, etc.), the underlined part of Step 1 to Step 3 described above, that is, the initial vector, whether the inversion is performed, whether the dummy value is added. and information including one or more of a location may be stored in the mapping table.

In addition, as described above, the server 120 may generate different N obfuscated scripts. In this case, the information included in each obfuscated script is stored in the mapping table for each obfuscated script. can be saved

Examples of information stored in the mapping table are as follows.

001 : {UID:'ab', PWD:'xyz', SIGN:'f5'… }

002 : {… }

003 : {… }

…

00N: {… }

As such, the server 120 stores information included in each obfuscated script in the mapping table, so that it is possible to check how each obfuscated script is obfuscated.

Next, the server 120 transmits one of the N obfuscated scripts to the client 110 in response to the script request in step S302 (S308). In this case, the server 120 may record, in the session, the number of the obfuscated script transmitted to the client 110 among the N obfuscated scripts.

Next, the client 110 receives login information from the user (S310). Here, the login information may be, for example, the parameter value described above.

Next, the client 110 receives a click of the login button set by the user on the web browser (S312).

According to the click of the login button in step S312, the obfuscated script is executed, and parameter keys and parameter values are randomly substituted according to the methods of Tables 1 and 2 described above (S314).

Next, as the parameter key and parameter value are substituted, a random URL is generated according to the method of Step 1 to Step 3 described above (S316).

Next, the client 110 transmits the random URL request to the server 120 (S318). At this time, the random URL is not a fixed URL (eg, login.do) unlike the prior art, but is generated differently each time a login request is made, and information included in the random URL is stored in the mapping table in step S306. have.

Finally, as the server 120 receives a request of a random URL from the client 110 , the request received from the client 110 (that is, the request in step S318 ) through information stored in the session is n It is confirmed that the request is generated through the second obfuscated script, and through this, the request of the client 110 is verified (S320).

Specifically, the server 120 may verify the validity of the random URL with reference to the mapping table. For example, the server 120 extracts the parameter P with reference to the information of the nth obfuscated script included in the mapping table, hashes the parameter P into an initial vector stored in the mapping table, and then the client The validity of the random URL may be verified by comparing two values derived by performing the same process on the random URL received from 110 .

Also, the server 120 may extract a parameter key and a parameter value before substitution with reference to the mapping table, and verify the request by comparing the parameter key and parameter value extracted from the random URL, respectively. If no error occurs as a result of the verification, the server 120 may determine that the script request for the login is normal and allow the login of the client 110 . If an error occurs as a result of such verification, the server 120 may determine that the script request for the login is abnormal and may not allow the login of the client 110 .

As described above, according to the exemplary embodiment, the obfuscated script is transmitted to the client 110 according to the login script request of the client 110, and as the obfuscated script is executed, a request of a random URL is transmitted to the server ( 120) can be transmitted. In this case, since the URL for login is calculated differently each time instead of being fixed as in the prior art, the automation program 130 cannot transmit the HTTP Request in the desired form by the server 120 .

The automation program 130 may receive the obfuscated script by requesting the login script to the server 120 like the client 110, but it does not launch a web browser, so the obfuscated script must be analyzed in real time. It becomes impossible to process multiple login requests at once. Specifically, the automation program 130 has login information for the user's ID, password, certificate, etc., but analyzes the obfuscated script every time to put the login information in a number-dimensional array, and at what index of the array. It is necessary to analyze the obfuscated script in real time to find out what dummy value to put in a specific index, whether the initial vector and inversion of the hash function used in the URL generation process, and whether or not to add a dummy value and location

Meanwhile, although only an example of preventing automatic web log-in through the automation program 130 has been described here, the above-described method may be equally applied to movement of a general web page other than log-in. In this case, step S302 of FIG. 3 may be changed to a script request for moving a web page instead of a request for a script for login, and steps S310 and S312 are input for moving a web page instead of inputting login information/clicking a login button or web It can be changed by clicking the page move button. The remaining steps may be applied in the same manner as described above in FIG. 3 .

4 is a detailed configuration diagram of the server 120 according to an exemplary embodiment. As shown in FIG. 4 , the server 120 according to the exemplary embodiment includes a request receiving unit 402 , a randomizing unit 404 , a responding unit 406 , and a verifying unit 408 .

The request receiving unit 402 receives a script request for logging in or moving a web page from the client 110 .

The randomizer 404 generates an obfuscated script after randomizing a parameter key, a parameter value, and a Uniform Resource Locator (URL) for the login or web page movement.

Specifically, the randomizer 404 substitutes the parameter key and the parameter value, respectively, sets an initial vector of a hash function at random, and hashes the substituted parameter key and the parameter value with the hash function to generate the random The script can be randomized so that only one URL is generated. In addition, the randomization unit 404 randomly selects whether the substituted parameter key and the parameter value are inverted, and randomly assigns a dummy value at any point of the substituted parameter key and the parameter value or the inverted value. In addition, the script can be randomized so that the random URL is generated. Thereafter, the randomizer 404 may obfuscate the randomized script as described above to generate the obfuscated script.

Also, the randomizer 404 stores information included in the obfuscated script in a set mapping table. In this case, the randomizer 404 may generate N different obfuscated scripts, and store information included in each of the obfuscated scripts in the mapping table for each obfuscated script. Here, the information stored in the mapping table may include, for example, one or more of the parameter key and information about before and after substitution of the parameter value, the initial vector, whether the inversion is performed, whether the dummy value is added, and a position. can

The response unit 406 transmits the obfuscated script to the client 110 in response to the script request. At this time, the response unit 406 transmits one of the N obfuscated scripts to the client 110 in response to the request for the script, and the obfuscated script transmitted to the client 110 is the second script. Recognition information may be recorded in a session.

As the random URL is generated from the obfuscated script, the verification unit 408 receives the request of the random URL from the client 110 and verifies the request based on information stored in the mapping table. Specifically, the verification unit 408 confirms that the request received from the client 110 is a request generated through the nth obfuscated script through the information stored in the session, and refers to the mapping table to determine the random One URL can be validated. Also, the verification unit 408 may verify the request by extracting the parameter key and the parameter value based on the information stored in the mapping table.

5 is an example illustrating a process of generating an obfuscated script in the randomizer 404 according to an exemplary embodiment and storing information included in the obfuscated script in a set mapping table.

Referring to FIG. 5 , the randomizer 404 randomizes parameter keys, parameter values, and URLs in the existing login script, then generates N obfuscated scripts, and divides the information included in each obfuscated script. Each obfuscated script may be stored in the mapping table.

6 is a block diagram illustrating and describing a computing environment including a computing device suitable for use in example embodiments. In the illustrated embodiment, each component may have different functions and capabilities other than those described below, and may include additional components other than those described below.

The illustrated computing environment 10 includes a computing device 12 . In one embodiment, computing device 12 may be server 120 , or one or more components included in server 120 .

Computing device 12 includes at least one processor 14 , computer readable storage medium 16 , and communication bus 18 . The processor 14 may cause the computing device 12 to operate in accordance with the exemplary embodiments discussed above. For example, the processor 14 may execute one or more programs stored in the computer-readable storage medium 16 . The one or more programs may include one or more computer-executable instructions that, when executed by the processor 14, configure the computing device 12 to perform operations in accordance with the exemplary embodiment. can be

Computer-readable storage medium 16 is configured to store computer-executable instructions or program code, program data, and/or other suitable form of information. The program 20 stored in the computer readable storage medium 16 includes a set of instructions executable by the processor 14 . In one embodiment, computer-readable storage medium 16 includes memory (volatile memory, such as random access memory, non-volatile memory, or a suitable combination thereof), one or more magnetic disk storage devices, optical disk storage devices, flash It may be memory devices, other forms of storage medium accessed by computing device 12 and capable of storing desired information, or a suitable combination thereof.

Communication bus 18 interconnects various other components of computing device 12 , including processor 14 and computer readable storage medium 16 .

Computing device 12 may also include one or more input/output interfaces 22 and one or more network communication interfaces 26 that provide interfaces for one or more input/output devices 24 . The input/output interface 22 and the network communication interface 26 are coupled to the communication bus 18 . Input/output device 24 may be coupled to other components of computing device 12 via input/output interface 22 . Exemplary input/output device 24 may include a pointing device (such as a mouse or trackpad), a keyboard, a touch input device (such as a touchpad or touchscreen), a voice or sound input device, various types of sensor devices, and/or imaging devices. input devices, and/or output devices such as display devices, printers, speakers and/or network cards. The exemplary input/output device 24 may be included in the computing device 12 as a component constituting the computing device 12 , and may be connected to the computing device 12 as a separate device distinct from the computing device 12 . may be

Although the present invention has been described in detail through representative embodiments above, those of ordinary skill in the art to which the present invention pertains can make various modifications to the above-described embodiments without departing from the scope of the present invention. will understand Therefore, the scope of the present invention should not be limited to the described embodiments, but should be defined by the claims described below as well as the claims and equivalents.

10: Computing Environment
12: computing device
14: processor
16: computer-readable storage medium
18: communication bus
20: Program
22: input/output interface
24: input/output device
26: network communication interface
110 : client
120 : server
130: automated program
402: request receiving unit
404: randomization unit
406: response part
408: verification unit

Claims (14)

Receiving, in the request receiving unit, a script request for login or web page movement from a client;
generating an obfuscated script after randomizing, in the randomizer, a parameter key, a parameter value, and a Uniform Resource Locator (URL) for logging in or moving a web page;
storing, in the randomizer, information included in the obfuscated script in a set mapping table;
transmitting, in a response unit, the obfuscated script to the client in response to the request for the script;
receiving, in a verification unit, a request for the random URL from the client as a random URL is generated from the obfuscated script; and
and verifying, in the verification unit, the request of the random URL based on the information stored in the mapping table,
The generating of the obfuscated script may include permuting the parameter key and the parameter value, randomly setting an initial vector of a hash function, and then performing the hash function with the substituted parameter key and the parameter value. Hash it as a function,
Randomly select whether to reverse the substituted parameter key and the parameter value, or randomly add a dummy value at any point of the substituted parameter key and the parameter value or the inverted value to generate the obfuscated script so that the random URL is generated, an automatic login prevention method using a random script.
The method according to claim 1,
Before sending the obfuscated script to the client,
generating, in the randomizer, N different obfuscated scripts; and
The method of preventing automatic login using a random script, further comprising the step of storing information included in each of the obfuscated scripts in the mapping table for each obfuscated script.
3. The method according to claim 2,
In the step of transmitting the obfuscated script to the client, one of the N obfuscated scripts is transmitted to the client in response to the request of the script, an automatic login prevention method using a random script.
delete delete The method according to claim 1,
The information stored in the mapping table includes one or more of the parameter key and information about before and after substitution of the parameter value, the initial vector, whether the inversion is performed, whether or not the dummy value is added, and a position. How to prevent login.
7. The method of claim 6,
The verifying of the request of the random URL may include verifying the validity of the random URL by referring to the mapping table, and verifying the request by extracting the parameter key and the parameter value based on information stored in the mapping table. How to prevent automatic login using random script.
a request receiving unit for receiving a script request for logging in or moving a web page from a client;
After randomizing a parameter key, parameter value, and URL (Uniform Resource Locator) for the login or web page movement, an obfuscated script is generated, and the obfuscated script is included in the a randomizer for storing information in a set mapping table;
a response unit transmitting the obfuscated script to the client in response to the script request; and
and a verification unit that receives the request of the random URL from the client as a random URL is generated from the obfuscated script, and verifies the request of the random URL based on information stored in the mapping table,
The randomizer replaces each of the parameter key and the parameter value, randomly sets an initial vector of a hash function, and then hashes the substituted parameter key and the parameter value with the hash function,
Randomly select whether to reverse the substituted parameter key and the parameter value, or randomly add a dummy value at any point of the substituted parameter key and the parameter value or the inverted value To generate the obfuscated script so that the random URL is generated, the server.
9. The method of claim 8,
The randomizer generates N different obfuscated scripts, and stores information included in each of the obfuscated scripts in the mapping table for each obfuscated script.
10. The method of claim 9,
The response unit, in response to the script request, transmitting one of the N obfuscated scripts to the client, the server.
delete delete 9. The method of claim 8,
The information stored in the mapping table includes one or more of the parameter key and information about before and after substitution of the parameter value, the initial vector, whether the inversion is performed, whether the dummy value is added, and a position.
14. The method of claim 13,
The verification unit verifies validity of the random URL with reference to the mapping table, and extracts the parameter key and the parameter value based on information stored in the mapping table to verify the request of the random URL.

Images